So you want to manage risk in the bank, but you are struggling with how to do that, which metrics to use and you want to avoid making mistakes. If this approximates your current thinking, don't worry because you aren't alone. Driven by a desire to control risk better than in the past or simply a desire to address increased regulatory pressure, community bankers are working diligently to establish a risk management framework that works. The problem is that given the complexity of the problem, no simple solution works for all. In addition, the dynamics of the market are forcing ongoing changes, just when you think you have things figured out. So, rather than focus in on what bankers should be doing in risk management, today we focus on areas where care should be taken to avoid the sort of folly humans are known for.
First, it is important to understand that eliminating the risk of significant events is almost impossible. Humans are fallible, systems are fallible and data is often not in a form required to handle such analysis anyway. As a current day reminder, look no further than the economic and banking crisis we are all going through right now - no model or person we know of predicted its scope, depth or ultimate impact; despite all the smart "white coat" types running around major financial companies, government agencies and higher education schools across the country. Clearly, predicting the next "big whammy" event, given the interconnected nature of the world, is murky at best and highly unlikely for certain. Since these events are going to happen and we won't see them coming, one key goal of risk management is to understand potential exposures and attempt to mitigate them as much as reasonably possible.
Therefore, instead of spending time trying to predict when a major event will happen, bankers would be better served measuring and preparing a contingency plan in the event such an event does occur. The more you plan for such events, the more you will be prepared when they eventually occur and the less you will need to guess about what to do and when to do it.
Next, get yourself a mutual fund disclaimer and read it. If you do, you will see a sentence required by the SEC that says "past performance is not an indication of future performance." That is because the historical world we remember and like to draw on to make sense of things around us is nothing like the world of today. We don't ride horses to work anymore, many don't watch TV on a television anymore and the home phone is on the way out. Interdependencies, an interconnected world, the internet and plain random walk mean there is no true "normal". As such, unlikely events will be the ones that wipe out huge chunks of profitability in the blink of an eye. Leaning too much on the past, running that through your models and then believing it will reoccur is fraught with risk.
The third thing to do is to forget the "best case" and focus on results of tests that don't show such a rosy scenario. Ask yourself whether you would still be comfortable and/or survive in such an event. Sure, we all like to see the positive side of things, but research shows using a best case scenario can be a recipe for disaster and increase our appetite for risk. We are human, and as such, optimistic scenarios are usually favored over pessimistic ones. As such, when evaluating risks, don't believe the hype, build on that hype, or try to frame the argument to serve your own purposes. Be skeptical, as you test, retest and test again from multiple angles. This will ensure you are reasonably comfortable with any risk being measured.
Finally, understand the limitations of the modelers and the risk takers. People are people, so they tend to overestimate their abilities and underestimate the risk of a given event or issue cropping up. To get further down the road on risk management, focus on being more aware, have a heavy degree of skepticism and be sure to evaluate a multitude of risks to understand where the biggest issues may surface.